replacing host in proxmox

[Spiros Pap]

Hi all,

I tried to replace a host in my cluster. I removed the host from the cluster with the command "pvecm delnode hs2", reinstalled from scratch the new host with the same name (hs2) and then added the new host.

The hosts was added succesfully, but when i try to migrate a VM, it says:
2019-06-09 22:40:07 # /usr/bin/ssh -e none -o 'BatchMode=yes' -o 'HostKeyAlias=hs2' root@10.8.2.2 /bin/true
2019-06-09 22:40:07 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
2019-06-09 22:40:07 @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
2019-06-09 22:40:07 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
2019-06-09 22:40:07 IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
2019-06-09 22:40:07 Someone could be eavesdropping on you right now (man-in-the-middle attack)!
2019-06-09 22:40:07 It is also possible that a host key has just been changed.
2019-06-09 22:40:07 The fingerprint for the ECDSA key sent by the remote host is
2019-06-09 22:40:07 SHA256:YN2DkA2E3dGF412JADL1VGGLCAOMRbqYPn8yPuHwWQk.
2019-06-09 22:40:07 Please contact your system administrator.
2019-06-09 22:40:07 Add correct host key in /root/.ssh/known_hosts to get rid of this message.
2019-06-09 22:40:07 Offending RSA key in /etc/ssh/ssh_known_hosts:7
2019-06-09 22:40:07 remove with:
2019-06-09 22:40:07 ssh-keygen -f "/etc/ssh/ssh_known_hosts" -R hs2
2019-06-09 22:40:07 ECDSA host key for hs2 has changed and you have requested strict checking.
2019-06-09 22:40:07 Host key verification failed.
2019-06-09 22:40:07 ERROR: migration aborted (duration 00:00:00): Can't connect to destination address using public key


It seems that the old cluster members remember the old pubkey of hs2. How can i make them forget about it and install the new pub keys?

I deleted the offending keys from both /etc/ssh/ssh_known_hosts and /root/.ssh/known_hosts, but now the /etc/ssh/ssh_known_hosts is not populated with the new keys

What is the right procedure to populate both files, in order to keep my cluster happy?


Thank you,
Spiros

 

[sb-jw]

Thats the correct and documented way: https://pve.proxmox.com/wiki/Proxmox_VE_4.x_Cluster#Re-installing_a_cluster_node

Normally it should be enough to delete the known host entry and jump to the new node, so you can accept the fingerprint.

 

[Chris]

It seems that the old cluster members remember the old pubkey of hs2. How can i make them forget about it and install the new pub keys?

Hi,
you can perform a `pvecm updatecerts`.

 

[demonmaestro]

I got two nodes that I type in the updatecerts command and it works a little while and then it stops working.